IPSEC Phase 1 and Phase 2 is up but return traffic not observed on Fortigate

Forum|Forum|6 years ago
July 23, 2020
3 replies
3202 views

Hi,

Issue is as above. Peering firewall is a Cisco Firepower.

Site A - FW A (Fortigate) <IPSEC tunnel> FW B (Cisco Firepower) - Site B

IPSEC P1, P2 is up and green. We're attempting SSH to reach Site B machine from Site A. We are seeing the traffic leaving from site A, routed through the tunnel interface via a diagnose sniffer packet, and from the Site B machine tcpdump we are seeing the Syn traffic reaching the machine and return traffic sent. FW B's administrator is seeing the return traffic from Site B as well and forwards it back to Site A, but we're not seeing the traffic on Fortigate (FW A) and causing a timeout of the SSH attempt either from diagnose sniffer packet, network capture from the Fortigate or a diagnose debug flow.

I've been scratching my head and not too sure on what's the next step I could take, so any feedback or questions is appreciated.

Thanks in advance.

darthro132

New Member

We had the same issue, I worked with Fortinet support and tech support for the other side and we couldn't figure it out either. What we ended up doing was migrating the tunnel off of our secondary ISP to our Primary and it came up.

ntaneja

Staff & Editor

Hi theengineer

Please run sniffer for both side public IP address and check if you see in and out esp packets on FGT A.
It's possible that ISP on site A FGT which is used to bind this vpn tunnel is blocking incoming esp traffic.

Thanks